OCTOPUS SERVER · CVE-2026-124628 · Vendor
FIX → 2026.3.15936 +1 ✓ verified
Octopus Server did not properly check changes a user made to their own LDAP identity, so users could edit it even when an administrator had disabled self-service identity editing. This can add the user to teams mapped to LDAP groups they do not belong to, and can escalate to full administrator rights if those teams are privileged.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Octopus Server (Linux and Windows) using LDAP authentication with LDAP groups mapped to Octopus teams. A user can edit their own LDAP identity even when an administrator disabled that, and join teams mapped to groups they are not in, up to full administrator if a mapped team is privileged. Instances without LDAP or without group-to-team mappings can skip it.
Not affected if no-group-mapping, no-ldap
Who cares ldap, octopus-deploy, self-hosted
In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 2026.3.15936 +1
2026.2.13526 or later in the 2026.2 line, or 2026.3.15936 or later in the 2026.3 line2026.3.161172026.2.13526 or greater